From: Stefano Stabellini <[email protected]>
The VCPUOP_register_runstate_memory_area hypercall takes a virtual
address of a buffer as a parameter. The semantics of the hypercall are
such that the virtual address should always be valid.
When KPTI is enabled and we are running userspace code, the virtual
address is not valid, thus, Linux is violating the semantics of
VCPUOP_register_runstate_memory_area.
Do not call VCPUOP_register_runstate_memory_area when KPTI is enabled.
Signed-off-by: Stefano Stabellini <[email protected]>
CC: Bertrand Marquis <[email protected]>
CC: [email protected]
CC: [email protected]
---
arch/arm/include/asm/xen/page.h | 5 +++++
arch/arm/xen/enlighten.c | 6 ++++--
arch/arm64/include/asm/xen/page.h | 6 ++++++
3 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/arm/include/asm/xen/page.h b/arch/arm/include/asm/xen/page.h
index 31bbc803cecb..dc7f6e91aafa 100644
--- a/arch/arm/include/asm/xen/page.h
+++ b/arch/arm/include/asm/xen/page.h
@@ -1 +1,6 @@
#include <xen/arm/page.h>
+
+static inline bool xen_kernel_unmapped_at_usr(void)
+{
+ return false;
+}
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index e93145d72c26..ea76562af1e9 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -158,7 +158,8 @@ static int xen_starting_cpu(unsigned int cpu)
BUG_ON(err);
per_cpu(xen_vcpu, cpu) = vcpup;
- xen_setup_runstate_info(cpu);
+ if (!xen_kernel_unmapped_at_usr())
+ xen_setup_runstate_info(cpu);
after_register_vcpu_info:
enable_percpu_irq(xen_events_irq, 0);
@@ -387,7 +388,8 @@ static int __init xen_guest_init(void)
return -EINVAL;
}
- xen_time_setup_guest();
+ if (!xen_kernel_unmapped_at_usr())
+ xen_time_setup_guest();
if (xen_initial_domain())
pvclock_gtod_register_notifier(&xen_pvclock_gtod_notifier);
diff --git a/arch/arm64/include/asm/xen/page.h b/arch/arm64/include/asm/xen/page.h
index 31bbc803cecb..dffdc773221b 100644
--- a/arch/arm64/include/asm/xen/page.h
+++ b/arch/arm64/include/asm/xen/page.h
@@ -1 +1,7 @@
#include <xen/arm/page.h>
+#include <asm/mmu.h>
+
+static inline bool xen_kernel_unmapped_at_usr(void)
+{
+ return arm64_kernel_unmapped_at_el0();
+}
--
2.17.1
Hi,
> On 25 Sep 2020, at 00:49, Stefano Stabellini <[email protected]> wrote:
>
> From: Stefano Stabellini <[email protected]>
>
> The VCPUOP_register_runstate_memory_area hypercall takes a virtual
> address of a buffer as a parameter. The semantics of the hypercall are
> such that the virtual address should always be valid.
>
> When KPTI is enabled and we are running userspace code, the virtual
> address is not valid, thus, Linux is violating the semantics of
> VCPUOP_register_runstate_memory_area.
>
> Do not call VCPUOP_register_runstate_memory_area when KPTI is enabled.
>
> Signed-off-by: Stefano Stabellini <[email protected]>
Reviewed-by: Bertrand Marquis <[email protected]>
I tested this on an Arm64 FVP and Errors generated by Xen are not present anymore.
Thanks a lot for the patch Stefano.
Cheers,
Bertrand
> CC: Bertrand Marquis <[email protected]>
> CC: [email protected]
> CC: [email protected]
> ---
> arch/arm/include/asm/xen/page.h | 5 +++++
> arch/arm/xen/enlighten.c | 6 ++++--
> arch/arm64/include/asm/xen/page.h | 6 ++++++
> 3 files changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm/include/asm/xen/page.h b/arch/arm/include/asm/xen/page.h
> index 31bbc803cecb..dc7f6e91aafa 100644
> --- a/arch/arm/include/asm/xen/page.h
> +++ b/arch/arm/include/asm/xen/page.h
> @@ -1 +1,6 @@
> #include <xen/arm/page.h>
> +
> +static inline bool xen_kernel_unmapped_at_usr(void)
> +{
> +return false;
> +}
> diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
> index e93145d72c26..ea76562af1e9 100644
> --- a/arch/arm/xen/enlighten.c
> +++ b/arch/arm/xen/enlighten.c
> @@ -158,7 +158,8 @@ static int xen_starting_cpu(unsigned int cpu)
> BUG_ON(err);
> per_cpu(xen_vcpu, cpu) = vcpup;
>
> -xen_setup_runstate_info(cpu);
> +if (!xen_kernel_unmapped_at_usr())
> +xen_setup_runstate_info(cpu);
>
> after_register_vcpu_info:
> enable_percpu_irq(xen_events_irq, 0);
> @@ -387,7 +388,8 @@ static int __init xen_guest_init(void)
> return -EINVAL;
> }
>
> -xen_time_setup_guest();
> +if (!xen_kernel_unmapped_at_usr())
> +xen_time_setup_guest();
>
> if (xen_initial_domain())
> pvclock_gtod_register_notifier(&xen_pvclock_gtod_notifier);
> diff --git a/arch/arm64/include/asm/xen/page.h b/arch/arm64/include/asm/xen/page.h
> index 31bbc803cecb..dffdc773221b 100644
> --- a/arch/arm64/include/asm/xen/page.h
> +++ b/arch/arm64/include/asm/xen/page.h
> @@ -1 +1,7 @@
> #include <xen/arm/page.h>
> +#include <asm/mmu.h>
> +
> +static inline bool xen_kernel_unmapped_at_usr(void)
> +{
> +return arm64_kernel_unmapped_at_el0();
> +}
> --
> 2.17.1
>
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
On 9/24/20 7:49 PM, Stefano Stabellini wrote:
> From: Stefano Stabellini <[email protected]>
>
> The VCPUOP_register_runstate_memory_area hypercall takes a virtual
> address of a buffer as a parameter. The semantics of the hypercall are
> such that the virtual address should always be valid.
>
> When KPTI is enabled and we are running userspace code, the virtual
> address is not valid, thus, Linux is violating the semantics of
> VCPUOP_register_runstate_memory_area.
>
> Do not call VCPUOP_register_runstate_memory_area when KPTI is enabled.
>
> Signed-off-by: Stefano Stabellini <[email protected]>
> CC: Bertrand Marquis <[email protected]>
> CC: [email protected]
> CC: [email protected]
Applied to for-linus-5.10
-boris